Vendor
Qualcomm
3,001 known vulnerabilities.
Products
3,001 results · Feed
-
High 8.4
Improper Access Control in Automotive Multimedia
Memory corruption in Automotive Multimedia due to improper access control in HAB.
-
High 7.8
Use of out-of-range pointer offset in Video
Memory corruption when malformed message payload is received from firmware.
-
High 7.8
Use of Out-of-range Pointer Offset in PCIe
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in HLOS
Memory corruption in HLOS while converting from authorization token to HIDL vector.
-
Medium 5.9
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
-
Critical 9.3
Buffer copy without checking size of Input in Core
Memory corruption in Core while processing control functions.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing IIR config data from AFE calibration block.
-
Medium 6.7
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure in Audio while accessing AVCS services from ADSP payload.
-
Medium 5.5
Buffer Over-read in Audio
Transient DOS in Audio when invoking callback function of ASM driver.
-
High 7.1
Buffer Over-read in Core
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
-
High 8.2
Buffer Copy Without Checking Size of Input in Modem
Information disclosure in Modem while processing SIB5.
-
High 7.5
Improper Input Validation in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
-
High 7.5
Improper Release of Memory Before Removing Last Reference in Multi-Mode Call Processor
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
-
High 8.4
Use After Free in DSP Services
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
-
High 7.5
Buffer Over-read in Qualcomm ESL
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
-
High 7.5
Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
-
High 7.8
Use After Free in Audio
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
-
High 7.8
Use After Free in Automotive Audio
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
-
High 7.8
Use After Free in Audio
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
-
High 7.5
Buffer over-read without Checking Size of Input in WLAN Host
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
-
High 8.4
Use after free in Neural Processing Unit
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
-
High 8.4
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
-
High 7.8
Use of Out-of-range Pointer Offset in Audio
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory cor…
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
-
High 8.4
Use After Free in Graphics
Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
-
High 8.4
Use After Free in Linux Graphics
Memory corruption while running VK synchronization with KASAN enabled.
-
High 7.8
Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in Wearables
Memory corruption in wearables while processing data from AON.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing a BTM request.
-
High 7.5
Buffer Over-read in Data Modem
Transient DOS in Data Modem during DTLS handshake.
-
Medium 6.7
Integer Overflow or Wraparound in Radio Interface Layer
Memory corruption while receiving a message in Bus Socket Transport Server.
-
High 7.1
Cryptographic Issues in Automotive
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
-
High 7.1
NULL Pointer Dereference in Hypervisor
Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
-
High 8.4
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio during playback with speaker protection.
-
Critical 9.3
Integer Overflow or Wraparound in TZ Secure OS
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
-
Critical 9.3
Buffer Copy without Checking Size of Input in HLOS
Memory corruption in HLOS while running playready use-case.
-
Critical 9.8
Buffer Copy without Checking Size of Input in Data Modem
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.